Privacy of Your Health Records

In Saskatchewan, The Health Information Protection Act (HIPA) protects all of your personal health information. It covers personal health information in any form, including:

• paper records
• electronic records
• information about physical or mental health
• information about any health services provided to someone
• information collected while providing health services to someone
• information about someone collected for the purpose of registering them to receive health services

Protecting patients' privacy is important for a number of reasons. Patients need to be comfortable enough to share all the information their health care provider needs to treat them. Knowing that their information will be kept private can make it easier to share sensitive information. At the same time, health care providers need to be able to share information in certain cases. For example, it could be needed in order to treat a patient or to monitor and improve our health care system.

The collection, storage, use and disclosure of personal health information is guided by these principles:

• personal health information is private and must be dealt with in a way that respects privacy
• wherever possible, personal health information should only be collected, used or disclosed with consent
• the primary purpose of collecting, using or disclosing personal health information is to benefit the patient
• personal health information is essential to providing health care and wherever possible should be collected directly from the patient
• personal health information must only be collected and disclosed on a need-to-know basis
• people have a right to be informed about anticipated uses and disclosures of their health information
• people must be able to access their own personal health records
• people and organizations involved with the Saskatchewan health system must protect the security, accuracy and integrity of personal health information

Under HIPA, people and organizations that collect, store or share personal health information are called trustees. This is to reflect the fact that they hold your personal health information in trust for you. They must manage it in ways that are in your best interest and that respect your right to privacy. Examples of trustees include:

• provincial government departments
• health care agencies
• physicians, nurses, pharmacists, dentists
• associations governing health care professionals

Your health information can only be collected or shared by a trustee with your consent unless one of the exceptions under HIPA applies. Your consent must be given freely. You have a right to any information you would reasonably need to decide whether to consent. Consent can be given for a limited period of time only. Consent does not need to be in writing. It can be given by your words or signature or implied from the situation. Your consent must relate to the specific use of your information requested.

There are a number of situations where your health information can be disclosed without your consent. Your information can be disclosed as needed for you to receive the treatment or services you have requested. Other exceptions to the requirement for consent include when:

• it is disclosed to someone who is entitled to make health care decisions for the patient
• the trustee reasonably believes it will minimize a danger to the health or safety of any person
• it is necessary for monitoring, preventing or revealing fraudulent, abusive or dangerous use of publicly funded health services
• it is needed by a quality of care committee or for a court case, or hearing before a health professional body
• it is disclosed in the process of collecting a payment from an agency for your health services
• it is disclosed to a government program that monitors drug use